Skip to content

Latest commit

 

History

History
191 lines (170 loc) · 29.2 KB

README_201903.md

File metadata and controls

191 lines (170 loc) · 29.2 KB
Raw

201903 信息源与信息类型占比

201903-信息源占比-secwiki

201903-信息源占比-xuanwu

201903-信息类型占比-xuanwu

201903-最喜欢语言占比

微信公众号 推荐

nickname_english weixin_no title url
下辈子想做头猪 galesec https://mp.weixin.qq.com/s/lGalf63VXCva2I5BpmSMgQ
云众可信 yunzhongkexin https://mp.weixin.qq.com/s/R4MdPVTOqUNg8-1HSOyQzw
信安之路 xazlsec https://mp.weixin.qq.com/s/5gwJpqj7ysue19OcoPI16A
天御攻防实验室 TianyuLab https://mp.weixin.qq.com/s/MP0tONsz5KRRa-swTwDh9w
天融信阿尔法实验室 https://mp.weixin.qq.com/s/RL8_kDoHcZoED1G_BBxlWw
奇安信威胁情报中心 https://mp.weixin.qq.com/s/If_Q0BlIZTiYp_7d1zJMWw
蓝海科学 BlueOceanScience https://mp.weixin.qq.com/s/MOJCYDN-W9KObOZpc6kx1g
51CTO技术栈 blog51cto https://mp.weixin.qq.com/s/UV6NoI6-Y3Zh4BR-m5jP8w
DI数据智能 https://mp.weixin.qq.com/s/z6Gfdp6ly0WdKjbrvhCACw
丁爸 情报分析师的工具箱 dingba2016 https://mp.weixin.qq.com/s/DoHc7G0yyW6iyORR0zxBBg
中科院信息科技战略情报 xxkjzlqb 美公布2020财年预算 国防部96亿美元资助网络活动 https://mp.weixin.qq.com/s/FHPhXYTeDlkAZ42N7-XVaQ
二当家的12138 https://mp.weixin.qq.com/s/z6Al0LT8Kqw_p_onhTyV2w
安天 Antiylab https://mp.weixin.qq.com/s/S0D3GPmhOKu65KAPpL_i_g
数字观星 shuziguanxing https://mp.weixin.qq.com/s/ehO5UWBlGuLmFCSPef_oyw
爱奇艺安全应急响应中心 iqiyi_71src https://mp.weixin.qq.com/s/TGswXl9cuwlRmaVsZs46hA
阿里机器智能 https://mp.weixin.qq.com/s/kv-ZrOF4nnxXoQwFOodzjA
Alfred数据室 Alfred_Lab https://mp.weixin.qq.com/s/j1kgf2RR7jssbWa7uWC-uA
中通安全应急响应中心 ZTO_SRC https://mp.weixin.qq.com/s/inANTt-97Rjfr6Rf5lJ07A
仙人掌情报站 sec-cactus https://mp.weixin.qq.com/s/vxQpnWKBYxzM4aZ3kFw4UA
我的安全视界观 CANI_Security https://mp.weixin.qq.com/s/sAQV0NEdIf05ofIxcIp-zg
透雾 wxWinder https://mp.weixin.qq.com/s/DCtKYK3Xw_pbdNCUF593Lg
Ms08067安全实验室 Ms08067_com https://mp.weixin.qq.com/s/xGYfxdp_TQmXiuWvC1sN-g
凌天实验室 LT_labs https://mp.weixin.qq.com/s/59Bj4qk-ClV2eqLu8SKniQ
安全学术圈 secquan https://mp.weixin.qq.com/s/bvQo-VHWdOEisR2adxx6yA
安在 AnZer_SH 新锐 盛华安张颖：左手SIEM右手服装设计的美女博士
数据安全与取证 Cflab_net https://mp.weixin.qq.com/s/ES83wSU-WBrUONGjCN6jYw
数说安全 SSAQ2016 https://mp.weixin.qq.com/s/agrm_Xgi1GJP3vmCiL4aVg
绿盟科技研究通讯 nsfocus_research https://mp.weixin.qq.com/s/1-yCu8dvp5GzOfK1i4LIhg
网信防务 CyberDefense https://mp.weixin.qq.com/s/GMvs_YE5W_m532touUOgfg
网安一起行_上海网警 shanghaiwangjing https://mp.weixin.qq.com/s/gAS2cFaWMUdY0s6sT6ZtHw
腾讯安全应急响应中心 tsrc_team https://mp.weixin.qq.com/s/rjcOK3A83oKHkpNgbm9Lbg

组织github账号 推荐

github_id title url org_url org_profile org_geo org_repositories org_people org_projects repo_lang repo_star repo_forks
Microsoft ChakraCore 的 3 月补丁发布 chakra-core/ChakraCore#6016 https://opensource.microsoft.com Open source, from Microsoft with love Redmond, WA 2297 4314 0 C,TypeScript,CMake,C#,JavaScript,C++,PowerShell,Python,Objective-C,HTML,F#,Java,Jupyter 71200 9500
mozilla Pwn2Own 2019 中 Firefox RCE 漏洞的补丁信息(CVE-2019-9813)：https://github.com/mozilla/gecko-dev/commit/601d226fe3690ff57287580431fd9a937298be80 https://github.com/mozilla/gecko-dev/commit/752be3958fc6f6eb83eaa4a35fae1a99dc54746e https://wiki.mozilla.org/Github This technology could fall into the right hands. Mountain View, California 1976 284 30 TypeScript,Jupyter,FreeMarker,Python,JavaScript,C++,Nix,HTML,CSS,Elixir,PHP,Ruby,Rust 0 0
facebook 通过同态散列算法安全地发布更新 - https://code.fb.com/security/homomorphic-hashing/ https://github.com/facebook/folly/blob/master/folly/experimental/crypto/LtHash.cpp https://opensource.fb.com We are working to build community through open source technology. NB: members must have two-factor auth. Menlo Park, California 161 187 0 C,TypeScript,Java,Python,JavaScript,OCaml,C++,Objective-C,Swift 0 0
MicrosoftEdge JsDbg: Debugging extensions for Microsoft Edge and Chromium-based browsers https://github.com/MicrosoftEdge/JsDbg None Microsoft Edge open source projects - demos, tools, data None 66 258 0 C#,JavaScript,C++,Python,HTML,PowerShell,CSS 0 0
RUB-NDS TLS-Attacker-BurpExtension - 检测 TLS 安全的BurpSuite 插件 https://github.com/RUB-NDS/TLS-Attacker-BurpExtension https://www.nds.ruhr-uni-bochum.de/ Research and development at the Chair for Network and Data Security concentrates on cryptographic protocols, Internet and XML security. Ruhr University Bochum 57 7 0 Python,CoffeeScript,PHP,Java,C++ 0 0
fireeye FireEye 开源 Windows 事件追踪辅助工具 - SilkETW https://github.com/fireeye/SilkETW http://blog.fireeye.com Milpitas, CA 44 1 0 C,Vue,Python,C++,C#,Visual,Go,PowerShell,CSS 0 0
appsecco using-docker-kubernetes-for-automating-appsec-and-osint-workflows https://github.com/appsecco/using-docker-kubernetes-for-automating-appsec-and-osint-workflows http://appsecco.com PRAGMATIC SECURITY ADVICE. PRACTICAL HELP. KEEPING YOU SAFE. London, Bangalore, Boston 32 5 0 Shell,Python,JavaScript,Visual,HTML,ActionScript,PHP,CSS 0 0
CheckPointSW Karta - source code assisted fast binary matching plugin for IDA https://github.com/CheckPointSW/Karta http://www.checkpoint.com Worlds leading provider of cyber security solutions to governments and corporate enterprises. Visit our CloudGuard Dome9 account at https://github.com/Dome9 http://www.checkpoint.com 27 2 0 C,TypeScript,Java,Python,JavaScript,C++,C#,HTML,Shell,ActionScript,CSS 0 0
tenable router_badusb: BadUSB in Routers https://github.com/tenable/router_badusb http://www.tenable.com/ Columbia, MD 26 4 0 C,Shell,Java,Python,C++,Vim,CoffeeScript,HTML,Emacs,Ruby,PowerShell 0 0
HexHive SMoTherSpectre PoC https://github.com/HexHive/SMoTherSpectre http://hexhive.github.io Enforcing memory safety guarantees and type safety guarantees at the compiler and runtime level http://hexhive.github.io 22 2 0 Python,C,HTML,Brainfuck,C++ 0 0
Coalfire-Research npk: A mostly-serverless distributed hash cracking platform https://github.com/Coalfire-Research/npk http://www.coalfirelabs.com Advancing the state of the Infosec industry by providing cutting-edge research, open-source tools and tradecraft http://www.coalfirelabs.com 16 0 0 C,Python,JavaScript,Lua,PowerShell,HCL 0 0
outflanknl 通过 DCOM 远程执行 Excel 4.0/XLM 宏实现横向渗透的利用脚本 https://github.com/outflanknl/Excel4-DCOM http://www.outflank.nl Clear advice with a hacker mindset. Red Teaming - Digital Attack Simulation - Incident Detection and Response Amsterdam, Netherlands, EU 15 1 0 C,Shell,C#,C++,Python,Visual,PowerShell,CSS 0 0
SafeBreach-Labs SirepRAT: Remote Command Execution as SYSTEM on Windows IoT Core https://github.com/SafeBreach-Labs/SirepRAT http://www.safebreach.com SafeBreach Labs Worldwide 12 2 0 Python,Shell 0 0
RhinoSecurityLabs CVE-2018-8024: Apache Spark XSS vulnerability in UI https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2018-8024 https://rhinosecuritylabs.com A boutique penetration testing and security assessment firm in Seattle, WA. Seattle, WA 10 0 0 Python,JavaScript,PowerShell,HCL 0 0
GhostPack harmj0y开源了 DPAPI 的 C#实现工具，关于DPAPI 的作用可以配合https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/这篇文章一起食用 https://github.com/GhostPack/SharpDPAPI None A collection of security related toolsets. None 8 0 0 C# 0 0
firecracker-microvm firecracker：Secure and fast microVMs for serverless computing https://github.com/firecracker-microvm/firecracker https://amazon.com/aws/ https://amazon.com/aws/ 6 6 0 Go,Shell,Rust 0 0
mitre-attack BZAR - 使用 Bro/Zeek 网络安全监控检测 ATT&CK 活动的项目 https://github.com/mitre-attack/car/tree/master/implementations/bzar mailto:[email protected] [email protected] 6 0 0 Bro,TypeScript,HTML,Python,JavaScript 0 0
BSidesSF BSidesSF CTF 2019 源码、DockerFile 及解决方案发布 https://github.com/BSidesSF/ctf-2019-release/tree/master/challenges https://bsidessf.org Security BSides San Francisco San Francisco, CA 4 4 0 C,HTML,Ruby,CSS 0 0
360-A-Team LuWu: 红队基础设施自动化部署工具 https://github.com/360-A-Team/LuWu None 360 A-TEAM has been renamed to QAX A-TEAM, check out https://github.com/QAX-A-Team None 1 0 0 0 0

私人github账号 推荐

github_id title url p_url p_profile p_loc p_company p_repositories p_projects p_stars p_followers p_following repo_lang repo_star repo_forks
s0md3v 绕过 WAF 的 XSS 检测机制研究 https://github.com/s0md3v/MyPapers/tree/master/Bypassing-XSS-detection-mechanisms https://github.com/s0md3v I make things, I break things and I make things that break things. Twitter: @s0md3v None None 30 0 0 2400 0 Python,JavaScript,Perl 0 0
skeeto endlessh - 一个伪造的 SSH 服务端，当攻击者连上后会不断收到 SSH Banner 信息以耗费时间 https://github.com/skeeto/endlessh https://nullprogram.com/ Maryland None 217 0 175 1300 15 C,Emacs,C++ 864 60
trimstray reload.sh - 通过 SSH 实现重装、恢复以及擦除系统的脚本 https://github.com/trimstray/reload.sh https://trimstray.github.io/ BIO_read(wbio, buf, 4096) Poland None 16 0 868 1200 270 Shell 17900 1600
jgamblin CarHackingTools: Install and Configure Common Car Hacking Tools. https://github.com/jgamblin/CarHackingTools https://www.jerrygamblin.com Researcher. Builder. Hacker. Traveler. Cedere Nescio. United States None 65 0 0 1000 2 C,Shell 0 0
unixpickle 一款针对 Go 二进制和包的混淆工具 https://github.com/unixpickle/gobfuscate https://aqnichol.com Web developer, math geek, and AI enthusiast. San Francisco, CA None 544 0 147 994 50 Python,Go,Objective-C,JavaScript 590 175
Urinx browspy: 浏览器用户全部信息收集JavaScript https://github.com/Urinx/browspy https://urinx.github.io ペットの元気子犬 Wuhan, China Huazhong Univ of Sci & Tech 40 0 61 866 11 Python,Swift 0 0
EtherDream jsproxy: 一个基于浏览器端 JS 实现的在线代理 https://github.com/EtherDream/jsproxy None [Geeker, Hacker) Hangzhou, China 0xA11BABA 25 0 172 864 5 Shell,JavaScript 3400 614
tyranid The Windows Sandbox Paradox （Flashback），来自 James Forshaw https://github.com/tyranid/infosec-presentations/blob/master/Nullcon/2019/The%20Windows%20Sandbox%20Paradox%20(Flashback).pdf None None None 31 0 0 638 2 C#,Python,C 700 197
Cryptogenic 在 PS4 6.20 上的 WebKit 远程代码执行漏洞（CVE-2018-4441）利用 https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit https://twitter.com/SpecterDev PHP/C++ developer with an interest in user-land and web exploitation. None None 28 0 38 613 5 Go,C,JavaScript,HTML 591 153
jakeajames Patchfinders for offsets used in bazads PAC bypass https://github.com/jakeajames/jelbrekLib/blob/master/patchfinder64.m None A random guy on the internet. Antartica None 68 0 4 439 7 Logos,C 291 133
rvrsh3ll 将 shellcode 隐藏在资源文件中再通过 CPL 加载执行的POC https://github.com/rvrsh3ll/CPLResourceRunner None I hack code together and hope it works. NOVA None 118 0 19 299 9 Python,C#,HTML,PowerShell 377 114
ExpLife0011 优秀 Windows 内核漏洞利用方向资源收集 https://github.com/ExpLife0011/awesome-windows-kernel-security-development/blob/master/README.md None None None 2800 0 3000 283 487 C,Assembly,Python,AngelScript,C++,C# 668 226
staaldraad Git Fetch 相关的漏洞利用研究(CVE-2018-11235 & CVE-2018-16873) https://github.com/staaldraad/troopers19/ https://github.com/heroku None @heroku 38 0 5 236 4 Go,Python,HTML 1200 473
zjlywjh001 披露一种针对W-IFI WPA/WPA2协议的MOTS(Man-On-The-Side)的攻击方式 https://github.com/zjlywjh001/CanSecWest19 https://www.jarviswang.me/ None None 52 0 5 202 0 C,JavaScript,Java 0 0
mpgn CVE-2019-9580 - StackStorm CORS 验证不当导致的 XSS + RCE 漏洞详情披露 https://github.com/mpgn/CVE-2019-9580/ https://github.com/QuokkaLight ̿ ̿̿̿\̵͇̿̿=(•̪●)=/̵͇̿̿/̿̿ ̿ ̿ ̿ Paris @QuokkaLight 33 0 149 174 14 Python,HTML,Java 123 37
TheKingOfDuck MySQLMonitor: MySQL实时监控工具（黑盒测试辅助工具） https://github.com/TheKingOfDuck/MySQLMonitor https://xz.aliyun.com/u/12470 贵州白马汇会所头牌,服务热线:https://xz.aliyun.com/u/12470 None GIT 34 0 7 151 4 Python,JavaScript 261 86
exodusintel CVE-2019-5786 FileReader Exploit https://github.com/exodusintel/CVE-2019-5786/ http://www.exodusintel.com Austin, TX Exodus Intelligence 6 0 0 151 0 Python,JavaScript 220 65
jesusprubio Awesome Node.js for penetration testers https://github.com/jesusprubio/awesome-nodejs-pentest https://github.com/IBMResearch A Coruña @IBMResearch 37 0 2500 148 75 TypeScript,JavaScript,Rust 0 0
houjingyi233 houjingyi233/CPU-vulnerabiility-collections https://github.com/houjingyi233/CPU-vulnerabiility-collections http://houjingyi233.com security researcher wechat:aG91amluZ3lpMTU5 None None 20 0 713 135 1 Visual,Java,C++ 124 56
xuechiyaobai Pwn2Own 2019 Firefox 远程代码执行漏洞(CVE-2019-9810)的 POC https://github.com/xuechiyaobai/CVE-2019-9810-PoC/ None None None 22 0 143 135 25 C,HTML,JavaScript,C++ 108 30
a13xp0p0v Linux 内核漏洞利用开发实验项目 https://github.com/a13xp0p0v/kernel-hack-drill https://twitter.com/a13xp0p0v Linux Kernel Developer & Security Researcher None None 5 0 0 119 3 Python,Go,C,HTML 436 44
bitsadmin Windows 漏洞利用辅助工具 https://github.com/bitsadmin/wesng None Netherlands None 9 0 4 118 0 C#,Python,Visual,Batchfile 0 0
Bypass007 Nessus_to_report: Nessus中文报告自动化脚本 https://github.com/Bypass007/Nessus_to_report None 欢迎关注公众号Bypass--，专注于信息安全。 Xiamen, China None 4 0 3 115 0 Python 596 131
kmkz 后渗透测试的真实案例分享，来自 Bsides Dublin 2019 大会 https://github.com/kmkz/PowerShell/tree/master/BsidesDublin-2019 http://www.linkedin.com/in/jean-marie-bourbon Grevenmacher (LU) None 11 0 18 101 9 Python,Assembly,PowerShell,Perl 245 51
xmendez 模糊测试及暴力破解工具收集的分享：https://twitter.com/Alra3ees/status/1103563481641611264 https://github.com/xmendez/wfuzz/ http://wfuzz.org IT Security Consultant Security Researcher; Twitter: @x4vi_mendez None None 4 0 6 98 1 Python,Ruby 1700
ze0r CVE-2018-8639-exp https://github.com/ze0r/CVE-2018-8639-exp/ None None None 5 0 5 91 5 Python,JavaScript,C++ 97 39
zMarch Orc - Bash 开发的 Linux 后渗透测试框架 https://github.com/zMarch/Orc https://attribution.party Pentester, hacker, forensicator. I write code, and sometimes I even publish it. Find me on twitter: https://twitter.com/_ta0 None None 6 0 2 67 10 Shell,Assembly,JavaScript 258 34
decoder-it powershellveryless - 绕过 Powershell 受限语言模式及 AMSI 的工具 https://github.com/decoder-it/powershellveryless/ None None None 9 0 1 63 0 C#,PowerShell,C++ 129 48
scarvell grandstream_exploits - Grandstream 设备中的 RCE 漏洞 EXPLOIT 集合 https://github.com/scarvell/grandstream_exploits None Australia None 22 0 54 63 37 Python,CoffeeScript,JavaScript,PHP 50 24
mcw0 HiSilicon DVR 黑客笔记 https://github.com/mcw0/pwn-hisilicon-dvr/blob/master/README.adoc None None None 5 0 3 57 2 Python 208 87
needmorecowbell Hamburglar: collect useful information from urls, directories, and files https://github.com/needmorecowbell/Hamburglar http://adammusciano.com Sharing is a moral imperative Pittsburgh, Pennsylvania Inquest 68 0 458 50 34 Python,YARA,C++ 0 0
codemayq 中文公开聊天语料库 https://github.com/codemayq/chaotbot_corpus_Chinese None new bird in nlp Beijing China Peking University 7 0 234 47 12 Python,TypeScript 725 192
vishnudxb automated-pentest-自动化扫描和生成渗透测试报告的 Parrot OS 系统容器 https://github.com/vishnudxb/automated-pentest http://www.vishnudxb.me Vishnu Nair is working as a Technology Lead in Taylor & Francis The Netherlands None 130 0 179 36 54 Go,Shell,Ruby,PHP 110 12
zznop bn-genesis - 协助分析 SEGA Genesis ROM 的 Binary Ninja 插件 https://github.com/zznop/bn-genesis None Dayton, Ohio None 12 0 116 36 17 Python,Java,C,Assembly 71 12
BusesCanFly Automate discovering and dropping payloads on LAN Raspberry Pis via ssh https://github.com/BusesCanFly/rpi-hunter None I make things, I break things. ¯_(ツ)_/¯ ‮‮‮ Somewhere in a linux server None 4 0 437 35 66 Python 0 0
dsnezhkov zombieant - 逃避 Linux EDR 检测的工具 https://github.com/dsnezhkov/zombieant/ None None None 33 0 170 33 8 C#,Python,C,Go,C++ 78 16
imjdl SearchApp: 小型网络空间搜索引擎 https://github.com/imjdl/SearchApp http://blog.blackarch.xyz Read The Fucking Source Code 菜雞一個 HK.China undergraduate 125 0 341 33 174 Python 0 0
Macr0phag3 GithubMonitor: 关键词监控GitHub泄漏 https://github.com/Macr0phag3/GithubMonitor https://www.tr0y.wang hello hacker ! None None 22 0 53 31 2 Python,Shell 0 0
AdrianVollmer PowerHub - 辅助 PowerSploit 绕过杀毒软件检测和应用白名单的 Web 应用 https://github.com/AdrianVollmer/PowerHub https://github.com/SySS-Research @mr_mitm Tübingen, Germany SySS GmbH @SySS-Research 8 0 33 29 13 Python,C,Ruby,PowerShell 126 15
si9int Inserting arbitrary files into Google Earth Projects Archives https://github.com/si9int/OFFSEC-Archive/blob/master/web/Inserting%20arbitrary%20files%20into%20Google%20Earth%20Projects%20Archives.pdf https://si9int.sh Whitehat in own definition None None 7 0 11 22 0 Python 0 0
SolomonSklash chomp-scan: 用于简化Bug Bounty/Penetration Test探测阶段的工具脚本 https://github.com/SolomonSklash/chomp-scan https://www.solomonsklash.io/ Senior penetration tester at FIS Global. None FIS Global 22 0 739 21 13 Python,Go,Shell 0 0
stevenaldinger stevenaldinger/decker: Declarative penetration testing orchestration framework https://github.com/stevenaldinger/decker https://www.linkedin.com/in/steven-aldinger-7a32a774/ None None 51 0 54 20 8 Go,Shell,HCL 208 14
Darkabode zerokit - GAPZ Bootkit 源码 https://github.com/Darkabode/zerokit None None None 6 0 0 18 0 C,Java,C++ 84 33
chrisnas DebuggingExtensions - 一款可以用于 Windows 和 Linux 的 .NET Core 控制台的调试工具 https://github.com/chrisnas/DebuggingExtensions/releases/tag/v1.6 None None None 9 0 2 18 1 C#,PowerShell 102 13
wish-i-was femida: Automated blind-xss search for Burp Suite https://github.com/wish-i-was/femida None Twitter https://twitter.com/wish_iwas None None 1 0 1 17 4 Python 100 24
alexfrancow A-Detector: An anomaly-based intrusion detection system. https://github.com/alexfrancow/A-Detector https://twitter.com/alexfrancow SysAdmin, Pentester and Python developer. Future OSCP and computer engineer. A Coruña, Spain None 22 0 52 16 13 Python,Ruby,CSS 0 0
CoreyD97 Stepper: A natural evolution of Burp Suites Repeater tool https://github.com/CoreyD97/Stepper https://github.com/nccgroup Security Consultant @nccgroup UK. United Kingdom NCC Group 8 0 6 14 2 JavaScript,Java 29 4
redaelli imago-forensics - Python 实现的图像数字取证工具 https://github.com/redaelli/imago-forensics None I’m a cyber security enthusiast. blog: https://www.forensics-matters.com/ twitter: @solventred None None 1 0 9 12 16 Python 66 12
0xpwntester Sysmon configuration and scripts https://github.com/0xpwntester/Sysmon None None None 9 0 6 11 3 Python,ASP,Batchfile,PowerShell,C++ 48 11
antonioCoco 一款自带混淆的ASPX类型的Webshell https://github.com/antonioCoco/SharPyShell None @splinter_code Italy None 1 0 3 10 7 Python 103 16
JuxhinDB OOB-Server: A Bind9 server for pentesters to use for Out-of-Band vulnerabilities https://github.com/JuxhinDB/OOB-Server https://github.com/JuxhinDB Twitter: @JuxhinDB Malta None 12 0 58 9 4 Python,Shell,Java,Rust 0 0
grigoritchy (browser exploit)Webkit JavascriptCore array unshift race condition, it leads to RCE. https://github.com/grigoritchy/unshift-racy None None None 1 0 0 7 0 JavaScript 11 4
Frint0 email-enum - 通过搜索主流社交网站判断邮箱是否注册的工具 https://github.com/Frint0/email-enum https://pwnable.club Pro Expert Elite Master Hacker Los Angeles None 3 0 1 5 1 Python,CSS 167 27
JarekMSFT MSRC 成员对 Microsoft bug bounty 的介绍、如何 润色 报告及获得更高的奖金 https://github.com/JarekMSFT/Presentations/blob/master/Getting%20to%2010K_Nullcon2019.pdf None None None 2 0 0 3 0 4 2
BloodHoundAD 域渗透神器 BloodHound2.1.0 发布 https://github.com/BloodHoundAD/BloodHound/releases/tag/2.1.0 None None None None 0 0 0 0 0 C#,Python,PowerShell 0 0
k8scop k8s-security-dashboard: A security monitoring solution for Kubernetes https://github.com/k8scop/k8s-security-dashboard None None None None 0 0 0 0 0 Python 0 0
xsleaks 一些可能导致跨域信息泄漏的 DOM API 收集 https://github.com/xsleaks/xsleaks/wiki/Browser-Side-Channels None None None None 0 0 0 0 0 0 0

medium_xuanwu 推荐

title url
从 Xceedium Xsuite 远程代码执行漏洞到域管权限的实际案例 http://medium.com/@DanielC7/remote-code-execution-gaining-domain-admin-privileges-due-to-a-typo-dbf8773df767
MikroTik RouterOS SMB 服务无需认证的 RCE 漏洞挖掘与利用(CVE-2018–7445) http://medium.com/@maxi./finding-and-exploiting-cve-2018-7445-f3103f163cc1
通过 Excel 文件执行命令以反弹 Meterpreter shell 的不同方法 http://medium.com/@Bank_Security/ms-excel-weaponization-techniques-79ac51610bf5
微软针对云网络安全打造的 SIEM 解决方案 - Azure Sentinel 介绍 http://medium.com/@maarten.goet/microsoft-azure-sentinel-not-your-daddys-splunk-3775bda28f39
红队评估物理环境安全性常用的五种方式 http://medium.com/@adam.toscher/top-5-ways-the-red-team-breached-and-assessed-the-physical-environment-fa567695b354
Vimeo 从 SSRF 到 SSH Key 泄漏 http://medium.com/@rootxharsh_90844/vimeo-ssrf-with-code-execution-potential-68c774ba7c1e
编写受密码保护的反弹 Shell (Linux/x64) http://medium.com/@0x0FFB347/writing-a-password-protected-reverse-shell-linux-x64-5f4d3a28d91a
我是如何在 redacted.com 挖到 Blind XSS 的 http://medium.com/@newp_th/how-i-find-blind-xss-vulnerability-in-redacted-com-33af18b56869
如何为 WinDbg 和 LLDB 编写 ClrMD 扩展 http://medium.com/@kevingosse/writing-clrmd-extensions-for-windbg-and-lldb-916427956f66
从 RCE 到 LDAP 信息泄漏 http://medium.com/@thbcn/from-rce-to-ldap-access-9ce4f9d2fd78
分析 Metasploit Linux/x64 reverse shell payload http://medium.com/@0x0FFB347/analysis-of-some-metasploit-network-payloads-linux-x64-ab8a8d11bbae
PostgreSQL 从 9.3 到 11.2 版本的认证用户任意命令执行漏洞披露（CVE-2019–9193） http://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
跨站点内容和状态类型泄漏 http://medium.com/@terjanq/cross-site-content-and-status-types-leakage-ef2dab0a492
XPWN 2018 Safari sandbox escape 中文版：https://weibo.com/ttarticle/p/show?id=2309404354112320866984 http://medium.com/p/one-liner-safari-sandbox-escape-exploit-91082ddbe6ef
使用 Sboxr 自动化发现和利用 DOM XSS - Part 1 http://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.appsecco.com%2Fautomating-discovery-and-exploiting-dom-client-xss-vulnerabilities-using-sboxr-part-1-2e55c120c9e1
使用 BadUSB 攻击路由设备控制目标网络 http://medium.com/tenable-techblog/owning-the-network-with-badusb-72daa45d1b00
使用 Sboxr 自动发现并利用 DOM XSS 漏洞 -  Part 2 http://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fblog.appsecco.com%2Fautomating-discovery-and-exploiting-dom-client-xss-vulnerabilities-using-sboxr-part-2-3b5c494148e0

medium_secwiki 推荐

title url
SVG XLink SSRF fingerprinting libraries version – Arbaz H... https://medium.com/@arbazhussain/svg-xlink-ssrf-fingerprinting-libraries-version-450ebecc2f3c
Finding and exploiting CVE-2018–7445 https://medium.com/@maxi./finding-and-exploiting-cve-2018-7445-f3103f163cc1
Host Header Poisoning in IBM Websphere https://medium.com/@x41x41x41/host-header-poisoning-in-ibm-websphere-3d459a990f00
3 XSS in ProtonMail for iOS – Vladimir Metnew – Medium https://medium.com/@vladimirmetnew/3-xss-in-protonmail-for-ios-95f8e4b17054
Writing a Password Protected Reverse Shell (Linux/x64) https://medium.com/@0x0FFB347/writing-a-password-protected-reverse-shell-linux-x64-5f4d3a28d91a
Writing a Custom Shellcode Encoder https://medium.com/@0x0FFB347/writing-a-custom-shellcode-encoder-31816e767611
SigintOS: A Wireless Pentest Distro Review https://medium.com/@tomac/sigintos-a-wireless-pentest-distro-review-a7ea93ee8f8b
Reflected XSS in SolarWinds Database Performance Analyzer https://medium.com/greenwolf-security/reflected-xss-in-solarwinds-database-performance-analyzer-988bd7a5cd5
使用 BadUSB 攻击路由设备控制目标网络 https://medium.com/tenable-techblog/owning-the-network-with-badusb-72daa45d1b00

zhihu_xuanwu 推荐

title url

zhihu_secwiki 推荐

title url
基于机器学习的攻击检测（二）下-lstm实现 https://zhuanlan.zhihu.com/p/58732540
基于机器学习的攻击检测（二）上-理解lstm https://zhuanlan.zhihu.com/p/58725390
基于机器学习的攻击检测（一） https://zhuanlan.zhihu.com/p/58689080
基于深度学习的webshell检测（二） https://zhuanlan.zhihu.com/p/58683374
基于机器学习的webshell检测（一） https://zhuanlan.zhihu.com/p/58676764
ICS安全工具系列3.1：多功能安全工具 https://zhuanlan.zhihu.com/p/60080122
ICS安全工具系列3.2：攻击指标（IOC）检测工具 https://zhuanlan.zhihu.com/p/60080388
ICS安全工具系列3.3：网络流量检测工具 https://zhuanlan.zhihu.com/p/60091755
控制系统设备：架构和供应渠道概述 https://zhuanlan.zhihu.com/p/58878866

日更新程序

python update_daily.py